On Thursday, Fortinet released an update for FortiWeb. Exploits have emerged that abuse the critical gap.

Well-written applications do this in a way that ensures that the parameters can never be interpreted as actual SQL commands. Badly written applications—which are, unfortunately, abundant—do not.